Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/05/2024, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
beeidcgjdh.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
beeidcgjdh.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe
-
Size
339KB
-
MD5
253b9761f72cd7db9603eac0e0d0cbab
-
SHA1
7a27cc29316d7cda05e0b3df3af0e586faa39c6e
-
SHA256
9f7053d5b628bace5e4ee888fda9426360751ebb36f6e39899397308107fb82a
-
SHA512
0ebaf728282df538e12c7fda5357675469bd504824e077b94ce0b32c69e44466631eea2176427cad79a9858bd4dceb658923bbcd60c38bba1f8b6b4314e1b1f0
-
SSDEEP
6144:4FJ0RBJwo19v2uGt0OLMxBoY/HWFAxfzC0ruv4ALxv3/ioimS:lBJwo19bGtlLvqHWixfuTvR/iohS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2192 beeidcgjdh.exe -
Loads dropped DLL 5 IoCs
pid Process 2184 253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe 2504 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2504 2192 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1384 wmic.exe Token: SeSecurityPrivilege 1384 wmic.exe Token: SeTakeOwnershipPrivilege 1384 wmic.exe Token: SeLoadDriverPrivilege 1384 wmic.exe Token: SeSystemProfilePrivilege 1384 wmic.exe Token: SeSystemtimePrivilege 1384 wmic.exe Token: SeProfSingleProcessPrivilege 1384 wmic.exe Token: SeIncBasePriorityPrivilege 1384 wmic.exe Token: SeCreatePagefilePrivilege 1384 wmic.exe Token: SeBackupPrivilege 1384 wmic.exe Token: SeRestorePrivilege 1384 wmic.exe Token: SeShutdownPrivilege 1384 wmic.exe Token: SeDebugPrivilege 1384 wmic.exe Token: SeSystemEnvironmentPrivilege 1384 wmic.exe Token: SeRemoteShutdownPrivilege 1384 wmic.exe Token: SeUndockPrivilege 1384 wmic.exe Token: SeManageVolumePrivilege 1384 wmic.exe Token: 33 1384 wmic.exe Token: 34 1384 wmic.exe Token: 35 1384 wmic.exe Token: SeIncreaseQuotaPrivilege 1384 wmic.exe Token: SeSecurityPrivilege 1384 wmic.exe Token: SeTakeOwnershipPrivilege 1384 wmic.exe Token: SeLoadDriverPrivilege 1384 wmic.exe Token: SeSystemProfilePrivilege 1384 wmic.exe Token: SeSystemtimePrivilege 1384 wmic.exe Token: SeProfSingleProcessPrivilege 1384 wmic.exe Token: SeIncBasePriorityPrivilege 1384 wmic.exe Token: SeCreatePagefilePrivilege 1384 wmic.exe Token: SeBackupPrivilege 1384 wmic.exe Token: SeRestorePrivilege 1384 wmic.exe Token: SeShutdownPrivilege 1384 wmic.exe Token: SeDebugPrivilege 1384 wmic.exe Token: SeSystemEnvironmentPrivilege 1384 wmic.exe Token: SeRemoteShutdownPrivilege 1384 wmic.exe Token: SeUndockPrivilege 1384 wmic.exe Token: SeManageVolumePrivilege 1384 wmic.exe Token: 33 1384 wmic.exe Token: 34 1384 wmic.exe Token: 35 1384 wmic.exe Token: SeIncreaseQuotaPrivilege 2684 wmic.exe Token: SeSecurityPrivilege 2684 wmic.exe Token: SeTakeOwnershipPrivilege 2684 wmic.exe Token: SeLoadDriverPrivilege 2684 wmic.exe Token: SeSystemProfilePrivilege 2684 wmic.exe Token: SeSystemtimePrivilege 2684 wmic.exe Token: SeProfSingleProcessPrivilege 2684 wmic.exe Token: SeIncBasePriorityPrivilege 2684 wmic.exe Token: SeCreatePagefilePrivilege 2684 wmic.exe Token: SeBackupPrivilege 2684 wmic.exe Token: SeRestorePrivilege 2684 wmic.exe Token: SeShutdownPrivilege 2684 wmic.exe Token: SeDebugPrivilege 2684 wmic.exe Token: SeSystemEnvironmentPrivilege 2684 wmic.exe Token: SeRemoteShutdownPrivilege 2684 wmic.exe Token: SeUndockPrivilege 2684 wmic.exe Token: SeManageVolumePrivilege 2684 wmic.exe Token: 33 2684 wmic.exe Token: 34 2684 wmic.exe Token: 35 2684 wmic.exe Token: SeIncreaseQuotaPrivilege 2124 wmic.exe Token: SeSecurityPrivilege 2124 wmic.exe Token: SeTakeOwnershipPrivilege 2124 wmic.exe Token: SeLoadDriverPrivilege 2124 wmic.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2192 2184 253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe 28 PID 2184 wrote to memory of 2192 2184 253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe 28 PID 2184 wrote to memory of 2192 2184 253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe 28 PID 2184 wrote to memory of 2192 2184 253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe 28 PID 2192 wrote to memory of 1384 2192 beeidcgjdh.exe 29 PID 2192 wrote to memory of 1384 2192 beeidcgjdh.exe 29 PID 2192 wrote to memory of 1384 2192 beeidcgjdh.exe 29 PID 2192 wrote to memory of 1384 2192 beeidcgjdh.exe 29 PID 2192 wrote to memory of 2684 2192 beeidcgjdh.exe 32 PID 2192 wrote to memory of 2684 2192 beeidcgjdh.exe 32 PID 2192 wrote to memory of 2684 2192 beeidcgjdh.exe 32 PID 2192 wrote to memory of 2684 2192 beeidcgjdh.exe 32 PID 2192 wrote to memory of 2124 2192 beeidcgjdh.exe 34 PID 2192 wrote to memory of 2124 2192 beeidcgjdh.exe 34 PID 2192 wrote to memory of 2124 2192 beeidcgjdh.exe 34 PID 2192 wrote to memory of 2124 2192 beeidcgjdh.exe 34 PID 2192 wrote to memory of 1276 2192 beeidcgjdh.exe 36 PID 2192 wrote to memory of 1276 2192 beeidcgjdh.exe 36 PID 2192 wrote to memory of 1276 2192 beeidcgjdh.exe 36 PID 2192 wrote to memory of 1276 2192 beeidcgjdh.exe 36 PID 2192 wrote to memory of 2496 2192 beeidcgjdh.exe 38 PID 2192 wrote to memory of 2496 2192 beeidcgjdh.exe 38 PID 2192 wrote to memory of 2496 2192 beeidcgjdh.exe 38 PID 2192 wrote to memory of 2496 2192 beeidcgjdh.exe 38 PID 2192 wrote to memory of 2504 2192 beeidcgjdh.exe 40 PID 2192 wrote to memory of 2504 2192 beeidcgjdh.exe 40 PID 2192 wrote to memory of 2504 2192 beeidcgjdh.exe 40 PID 2192 wrote to memory of 2504 2192 beeidcgjdh.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\253b9761f72cd7db9603eac0e0d0cbab_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\beeidcgjdh.exeC:\Users\Admin\AppData\Local\Temp\beeidcgjdh.exe 5)1)9)5)4)0)0)9)0)3)5 Kk9APzkyMyoyNBsqUkw9TElENDAdKklES1JLUktARDosGy47RE9USTs9LzQyNScbK0NJOz0tGypPSUpAVUNLX0Y/ODEwKywwICZTQk1RRElaUVJMNGhxb2s5JipvcnYlREJORixLSkwtQUdQK0RJRUYbK0NMQENIRD88aU5uOVdJN2tyVDhnRXB3LWYyMzItN05mSkgxZFMzcigzX2hKMzVrUGBhVWcpamhpYl0wNGpwRDktdjJ1RFFhPlxrP3JOWC1oUUxwQ0prQGYtMkB2MkZyaVZnLUd3ZlFmcnNmXWUxT2hCd2lCcHAtZV80dDggLD8sPCQsHC9EKT0qLBsuOy45LTEXL0EvOCwoGytENTQtLhsqT0lKQFVDS19NTURVOD5VPSAmUE9KP1Q6T1tFVUNBOhsqT0lKQFVDS19LPEhENE9rbVRmbUVqaGQpKTUuMxcvQlNAXkxNSD0kclVPR3gfJkBURV86TUFHRE08OBwvSEZTUVo9UUZST0VSNDUdKk9HOElHWU9MX1JNRzxfb3BwOiYvXl5naFpmKmFkX29gLCltXG8rQm0sby1BPUJFaSlYTUhVRGpwZVgvLD90az0vIXFgaSw5JnZYci84IXVYbS89Mi0xLyFLQktTOSZtNHtNTUpDTD5QX044TUJ4Gy5NSDkyICZEUCw4MS0sLiAvSVVLT0RMPFpTRUw6T0pAREw4QkFVUkM9HSpEUlZNUU5UQE1COG9xbGAcL1I8VFJNSUhFQltVUzxSXD88WEo4LiAvP0lBQFM8KBsrSVNWRFZJPExAPltFTjpSVktPRDs4YmFsamUdKj9OTklIT0E7X0ZLODEnMyoxMScuNi4pMCktHC9QOFI+R0dEQ1pFTlNLQUlHOHNpcGEgL0tJSkA4MCsvNDMzLDIwMRsuO0pTTkxGQUFaT0hEQDkxMSYyMSotLygwJjM6KTA3LjEpOEg=2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715177920.txt bios get serialnumber3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715177920.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715177920.txt bios get version3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715177920.txt bios get version3⤵PID:1276
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81715177920.txt bios get version3⤵PID:2496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 3683⤵
- Loads dropped DLL
- Program crash
PID:2504
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66B
MD59025468f85256136f923096b01375964
SHA17fcd174999661594fa5f88890ffb195e9858cc52
SHA256d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df
SHA51292cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51
-
Filesize
538KB
MD591681987d070bf6a72597875af3c57fe
SHA101ba9dc91f47e277c7a21f015a699a3727792979
SHA256c7ea8b08e5ccc3bf7b423be017d0d15d4e7c0dfbe036b3a2d704cf9e867fc759
SHA5129eb2e2c715032f00bd420803ea3c47da2cfd31d2e71c1c0a170d1d75336b901120daa11ecd29a2f7defd38fa28d2392a32c021b6b241a48239498a3a290cf4d4